法律幻觉校验器

Security checks across malware telemetry and agentic risk

Overview

This is a coherent legal-citation checking skill, but users should know it sends legal text to a disclosed third-party API and may save request/response files locally.

Install only if you are comfortable sending the legal text being checked to chineselaw.com through the configured API key. Avoid submitting privileged, confidential, or personal material unless you have authority to share it, protect any .env file, and remove generated body.json/response.json files when they contain sensitive content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs transmission of user-supplied legal text to a third-party API, but it does not require an explicit user-facing notice or consent step before external transfer. Legal documents can contain sensitive personal, commercial, or privileged information, so silent exfiltration to an external service creates a real privacy and compliance risk.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal